freeswan and ipsec
"Peter Marshall" <[email protected]> Fri, 15 Oct 2004 14:41:47 -0300
| Newsgroups | gmane.comp.security.vpn |
|---|---|
| Message-ID | <[email protected]> |
I am still having problems getting freeswan (on rh9) to work properly with
ipsec on openbsd. It works perfect when I run it between 2 rh9 boxes ...
however, I need it to work between rh9 and openbsd .....
On the openbsd console after I try to connect the two I get these messages
(A.B.C.102 is a routable Internet IP addreses)
Oct 15 11:29:04 mailtestlx isakmpd[7395]: message_recv: invalid cookie(s)
19708ba516163430 5429d55714d51b23
Oct 15 11:29:04 mailtestlx isakmpd[7395]: dropped message from A.B.C.102
port 500 due to notification type INVALID_COOKIE
Oct 15 11:29:27 mailtestlx isakmpd[7395]: transport_send_messages: giving up
on message 0x3c05da00
Oct 15 11:31:27 mailtestlx isakmpd[7395]: transport_send_messages: giving up
on message 0x3c05da00
Oct 15 11:33:27 mailtestlx isakmpd[7395]: transport_send_messages: giving up
on message 0x3c05da00
Oct 15 11:43:27 mailtestlx last message repeated 5 times
On the Rh9 box, I get this in the /var/log/secure file (A.B.C.? and
E.F.G.? are routable Internet IP addreses)
Oct 15 14:19:50 pmarshallx pluto[17009]: "bsdtest" #69: cannot respond to
IPsec SA request because no connection is known for
A.B.C.0/22===A.B.C.102...E.F.G.33===E.F.G.0/26
Oct 15 14:19:57 pmarshallx pluto[17009]: "bsdtest" #69: Quick Mode I1
message is unacceptable because it uses a previously used Message ID
0xf619efa3 (perhaps this is a duplicated packet)
Oct 15 14:20:06 pmarshallx pluto[17009]: "bsdtest" #69: Quick Mode I1
message is unacceptable because it uses a previously used Message ID
0xf619efa3 (perhaps this is a duplicated packet)
This is that I type on the linux box to start ipsec
[root@pmarshallx log]# /etc/init.d/ipsec start
ipsec_setup: Starting FreeS/WAN IPsec 2.06...
[root@pmarshallx log]# ipsec auto --up bsdtest
112 "bsdtest" #2: STATE_QUICK_I1: initiate
004 "bsdtest" #2: STATE_QUICK_I2: sent QI2, IPsec SA established
{ESP=>0x707d73c4 <0xb492011f}
This is what I type on the bsdbox
# isakmpd
#
This is the ipsec.conf file on the linux box
# basic configuration
config setup
interfaces="ipsec0=eth0"
# Debug-logging controls: "none" for (almost) none, "all" for lots.
# klipsdebug=all
# plutodebug=dns
conn bsdtest
#auto=start
auto=add
type=tunnel
keyexchange=ike
left=E.F.G.33
leftsubnet=192.168.200.0/21
leftnexthop=E.F.G.3
right=A.B.C.102
rightsubnet=10.0.0.0/24
rightnexthop=A.B.192.1
authby=secret
pfs=yes
This is the isakmpd.conf file on the openbsd box
[General]
Listen-on=E.F.G.33
[Phase 1]
A.B.C.102= ISAKMP-peer-B
[Phase 2]
Connections= IPsec-AB
[ISAKMP-peer-B]
Phase = 1
Transport = udp
Local-address = E.F.G.33
Address = A.B.C.102
Configuration = Default-main-mode
Authentication = mypassword
[IPsec-AB]
Phase = 2
ISAKMP-peer = ISAKMP-peer-B
Configuration = Default-quick-mode
Local-ID = Net-LOCAL
Remote-ID = Net-HOST2
[Default-main-mode]
DOI = IPSEC
EXCHANGE_TYPE = ID_PROT
Transforms = 3DES-SHA
[Default-quick-mode]
DOI = IPSEC
EXCHANGE_TYPE = QUICK_MODE
Suites = QM-ESP-AES-SHA-PFS-SUITE
[Net-LOCAL]
ID-type = IPV4_ADDR_SUBNET
Network = E.F.G.33
Netmask = 255.255.255.192
[Net-HOST2]
ID-type = IPV4_ADDR_SUBNET
Network = A.B.C.102
Netmask = 255.255.252.0
~
Any Help Would be greatly appriciated.
Thanks
Peter Marshall